The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade lcms2 | Aug 30, 2017 | Feb 3, 2017 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 8 installer 8.25 (JDK 8u152, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 9 installer 9.0.1 (JDK 9.0.1, PSU) (short-term support); migrate to JDK 11 (LTS)Apply legacy security update: Azul Zulu JDK 7 installer 7.21 (JDK 7u161, quarterly CPU) — Azul Legacy Production Support | Feb 3, 2017 | Feb 3, 2017 |
| Centos_linux | — | Upgrade java-1.7.1-ibm-pluginUpgrade java-1.8.0-ibmUpgrade java-1.7.1-ibm-develUpgrade java-1.8.0-ibm-demoUpgrade java-1.7.1-ibmUpgrade satellite-brandingUpgrade java-1.8.0-ibm-jdbcUpgrade satelliteUpgrade java-1.8.0-ibm-pluginUpgrade java-1.8.0-ibm-srcUpgrade java-1.7.1-ibm-demoUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.8.0-ibm-develUpgrade java-1.7.1-ibm-src | Oct 19, 2017 | Nov 12, 2016 |
| Debian | — | Upgrade lcms2 | Jan 30, 2017 | Jan 29, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade lcms2 | Dec 4, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade lcms2 | Dec 18, 2019 | Feb 3, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade lcms2 | Nov 19, 2019 | Feb 3, 2017 |
| Ibm Aix | — | Apply the fix or workaround for java_oct2017_advisory | Dec 8, 2017 | Dec 7, 2017 |
| Ibm Java | — | Upgrade IBM Java to version 8.0.5.5Upgrade IBM Java to version 7.1.4.15Upgrade IBM Java to version 7.0.10.15 | Oct 5, 2018 | Feb 3, 2017 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 18, 2017 | Feb 3, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Feb 3, 2017 |
| Redhat_linux | — | Upgrade java-1.7.1-ibm-demoUpgrade java-1.7.1-ibm-pluginUpgrade java-1.8.0-ibmUpgrade java-1.8.0-ibm-jdbcUpgrade java-1.7.1-ibm-jdbcUpgrade java-1.8.0-ibm-develUpgrade java-1.7.1-ibmNo solution existsUpgrade java-1.8.0-ibm-srcUpgrade java-1.8.0-ibm-demoUpgrade java-1.8.0-ibm-pluginUpgrade java-1.7.1-ibm-develUpgrade java-1.7.1-ibm-src | Feb 3, 2017 | Jan 29, 2017 |
| Suse | — | Upgrade liblcms2-2-32bitUpgrade lcms2Upgrade liblcms2-develUpgrade java-1_8_0-ibmUpgrade java-1_7_0-ibm-develUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-openjdkUpgrade java-1_8_0-openjdk-develUpgrade java-1_8_0-openjdkUpgrade java-1_7_0-ibm-alsaUpgrade java-1_8_0-ibm-alsaUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_8_0-openjdk-headlessUpgrade java-1_8_0-openjdk-demoUpgrade java-1_7_1-ibmUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_7_1-ibm-pluginUpgrade java-1_7_1-ibm-alsaUpgrade java-1_7_0-ibmUpgrade java-1_7_1-ibm-develUpgrade java-1_8_0-ibm-develUpgrade java-1_7_0-openjdk-headlessUpgrade java-1_8_0-ibm-pluginUpgrade java-1_7_0-openjdk-demoUpgrade java-1_7_0-openjdk-develUpgrade liblcms2-2 | Nov 10, 2017 | Jan 29, 2017 |
| Ubuntu | — | Upgrade liblcms1Upgrade liblcms2-2Upgrade liblcms2-utilsUpgrade liblcms-utils | Oct 2, 2018 | Jan 29, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub